Privacy Policy

VillaOS is software that villa and holiday-rental operators (“you”) use to run bookings, guests, payments and correspondence. For the information you put into VillaOS about your guests, partners and business, you are the controller and VillaOS is your processor: we handle it only to provide the service to you and on your instructions, under a data processing agreement. For the details of the people who sign in to VillaOS (you and your team), VillaOS is the controller.

• Account data — names, email addresses and roles of the people in your workspace, and your business details (name, address, VAT number, branding, settings).
• Business data you enter or import — properties, seasons and rates, channels and partners, bookings, guests (names, contact details, stay details, notes), payments, invoices, expenses and vouchers.
• Correspondence records — for email, a short snippet of each matched message (see section 3) with its sender, recipient, subject, date and message id; for WhatsApp, if you connect it, the messages you receive.
• Calendar data — reservations imported from the booking-channel calendar (iCal) feeds you add, and, if you turn it on, bookings copied to your Google Calendar.
• Integration credentials — the access tokens and keys for services you connect, stored encrypted (section 6).
• Operational records — an activity log of changes in your workspace, usage counts (for example AI requests), and technical error reports.

We do not sell personal data, and we do not use it for advertising.

Connecting Gmail is optional. When you connect it, Google asks you to grant two permissions: read, compose and send email (the “gmail.modify” scope) and, for the optional calendar sync, manage calendar events (“calendar.events”). VillaOS uses them as follows:

• Reading. VillaOS reads new mail in the connected mailbox to find messages to or from guests and partners already in your workspace, matched by email address. Messages that match nobody in your workspace — newsletters, personal mail, everything else — are not stored.
• Storing less. For a matched message, VillaOS stores only a short snippet (about the first 100 characters, with formatting removed) and the sender, recipient, subject, date and Gmail message id. The full message stays in Gmail; when you open it in VillaOS it is fetched from Gmail on demand and not saved. VillaOS will only fetch messages it already holds a record of for your workspace.
• Sending. Emails you write in VillaOS, and automated guest emails you set up, are sent from your Gmail account.
• Never deleting. VillaOS does not delete, move or relabel anything in your mailbox.
• Calendar. If you turn on Google Calendar sync, VillaOS creates and updates events for your bookings in your calendar.

VillaOS's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: Google user data is used only to provide the features described above; it is not sold, not used for advertising, and not used to train artificial-intelligence models. People at VillaOS do not read it, except with your permission (for example in a support session you ask for), where needed for security, or where the law requires it. You can disconnect Gmail at any time in Settings → Integrations; you can also remove VillaOS's access from your Google account settings.

Some features are powered by AI: drafting a reply to a guest, extracting booking details from a partner email, the in-app assistant and business insights. When you use them, VillaOS sends the text needed for that request to Anthropic (the Claude API). Before anything is sent, VillaOS removes contact and payment details — email addresses, phone numbers, bank account (IBAN) and card details. Reply drafts and the in-app assistant refer to guests by first name only. Booking extraction is different by design: to fill in the booking, it keeps the details it extracts — including the guest's full name, the dates, amounts and booking references.

Data sent to our AI provider through its commercial API is not used to train its models, and it is not used by VillaOS for training either. AI results are suggestions: nothing is sent to a guest or saved to a booking until you choose to.

• Supabase — database, sign-in and file storage. Hosted in the European Union (Ireland).
• Vercel — application hosting and privacy-friendly usage analytics.
• Anthropic — AI features (section 4), with personal details removed first.
• Google — Gmail and Google Calendar, only if you connect them (section 3).
• Sentry — error monitoring. Hosted in the European Union.

Where a sub-processor handles data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard. The current list, with what each receives, is available on request.

Data is encrypted in transit (TLS) and at rest on encrypted storage. Access tokens and keys for connected services — including Gmail — are additionally encrypted by VillaOS (AES-256-GCM) before they are stored, and are never sent to your browser. Each workspace's data is kept separate by database row-level security and by tenant checks on every server request. Changes in a workspace are recorded in its activity log.

• Account and business data: for as long as your workspace exists.
• Correspondence records (snippets and metadata): up to three years from the message date. A daily job identifies older records so they can be deleted. Full messages are never stored (section 3).
• Error reports: kept by our error-monitoring provider for a limited period (typically 90 days).
• When you delete your account, its data is deleted immediately from the live database. Copies may remain in encrypted infrastructure backups for a limited period until they are overwritten.

• Export everything — owners and admins can download all of a workspace's data as one JSON file in Settings → Data & privacy. Stored credentials are left out.
• Delete your account — the account owner can permanently delete the workspace, all of its data and every team login in Settings → Data & privacy. This also disconnects Gmail and revokes VillaOS's access to it.
• Requests from your guests — as the controller, you can export or erase an individual guest's records from that guest's page.
• Correct, restrict or object — most data can be edited in the app; for anything else, write to us.
• You may also complain to your local data protection authority. We would appreciate the chance to help first.

For privacy questions or requests — including a copy of our data processing agreement — contact privacy@villaos.app. If this policy changes materially, we will tell account owners before the change takes effect.